EXT: EXT:Security¶

Table of Contents¶

EXT: EXT:Security 1

Introduction 1

What does it do? 1

Administration 1

Configuration 2

Possible errors 2

Known problems 2

To-Do list 3

Changelog 3

Introduction¶

Administration¶

When installing the extension via the Extension Manager you are required to fill in the username and password of a mysql database user, which will get used for FE database queries. So you are not allowed to use the same username as set in the Install Tool when installing TYPO3.

As soon as you have set this username/password combination you will see a red message stating:

“The given FE database-username "t3_kicks" has inappropriate rights!”

and an additional message stating:

“Cannot connect to database using supplied credentials!”

This is because you have to create a mysql-database user with the supplied username/password combination an appropriate access rights. Right below those messages between two horizontal-lines you have a block of SQL queries, which have to get executed in the mysql shell with a mysql-root user, creating the required database-user and grantin appropriate access rights. The block will look something like:

GRANT SELECT, LOCK TABLES ON `t3_kickstarter`.`*` TO `t3_kicks`@`localhost` IDENTIFIED BY 'kicks';
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`cache_hash` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`cache_imagesizes` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`cache_md5params` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`cache_pages` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`cache_pagesection` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`cache_typo3temp_log` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`fe_session_data` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`fe_sessions` TO `t3_kicks`@`localhost`;
GRANT DELETE, INSERT, UPDATE ON `t3_kickstarter`.`fe_users` TO `t3_kicks`@`localhost`;

Those statements will create the appropriate user, assign a password, and grant required rights. Do NOT copy the above block, Copy&Paste those shown in your Extension Manager.

As soon as those access rights have been set, the FE is secured by tightening the access rights of the database object while in FE context. It will not have any influence on the BE.

Configuration¶

Only a small set of tables will be allowed for write access from the FE. Those tables are listed in the option:

Writeable tables [tablesWrite]

It may be possible that extension on your website require more tables to be writeable. For example if you have a guestbook, a voting or bloggin extension, or a mailing extension installed, which writes data to their tables, you will have to add the name of those tables to this comma separated list.

Of course it is not allowed to add tables like “be_users” to this list. In such a case you will get an error message when calling any page in the FE. If one of your extension REALLY requires to write a table like “be_users” you will have to manually remove this table from the class member variable “tables_denyWrite” in the class in file “class.tx_extsecurity_tsfeHook.php”.

Known problems¶

Probably there are some. None are known to me currently.

To-Do list¶

• Find a way to deny “read” access to tables like “be_users” while in FE context.
• Find other ways to tighten security of TYPO3.

Changelog¶